# AI risk register

PrivacyBuilt Editorial | Educational working model | 3 November 2026

Describe concrete harms and evidence. Do not invent numerical scores without a defined method. Approval does not override a legal restriction.

## Working fields

- Risk id: [complete / validate]
- System: [complete / validate]
- Use case: [complete / validate]
- Affected people: [complete / validate]
- Harm scenario: [complete / validate]
- Evidence: [complete / validate]
- Likelihood rationale: [complete / validate]
- Impact rationale: [complete / validate]
- Existing controls: [complete / validate]
- Additional controls: [complete / validate]
- Residual risk: [complete / validate]
- Decision: [complete / validate]
- Owner: [complete / validate]
- Review trigger: [complete / validate]

## Review and adoption

- Assign an owner and approver.
- Link official sources and operational evidence.
- Record exceptions, review triggers and a review date.
- Store completed copies in an approved restricted environment.